By Theuns Kotze, Managing Director Assurance BSI India, Middle East, Turkey and Africa
The pandemic has been a black swan event in our planet’s recent history. It has changed the way we live and interact. Of the many changes it has brought forth, there has been a wide acceptance of remote working. As more people choose to work from home, it brought with it a new practice of ‘bring your device’ which has had a cascading impact on companies and organisations becoming more cloud-based and digitally reliant. However, the move to remote working has increased the threat of cybersecurity risks that thrive among vulnerable networks, cloud-based infrastructure, and incautious employee work habits.
As organisations improve their digital resilience, cybercriminal methods are becoming increasingly sophisticated, globally extensive, and organisationally damaging. Research reports that after a breach, 21% of companies faced a loss of money, data, or assets, while one in three reported suffering wider business disruption such as lost staff time. Reputational loss to an organisation can also be devastating.
Organisations are aware of risk mitigation measures against cyber-attacks and most of them also have robust measures in place. However, there is a need for organisations to periodically evaluate and update systems to ensure that they remain protected at all times. The recent cyber-attacks on organisations in India like the ransomware attack on Delhi’s All-India Institute of Medical Sciences (AIIMS) and Air India data breach were not due to a lack of security information systems but rather due to outdated versions that couldn’t shield against multi-vector attacks. Therefore, companies and organisations worldwide must use updates on their cybersecurity system and ensure their information assets are secure.
A clear sense of responsibility lies in the organisation in case of a data breach. The recently updated ISO/IEC 27001 – 2022 standard for information security management provides a framework that ensures organisations have put in place best practices for information security processes and has assured data integrity, confidentiality, and, most of all, customer asset safety. This risk mitigation standard begins at the core of safety measurement: The Team!
The standard document arms an organisation to stay abreast of risks surrounding it by training the core team to understand, implement and align corporate objectives in line with the risk assessment. The team is trained and equipped to take an objective look at the evidence and justification for the inclusion or exclusion of necessary controls and update the organisation SOA (Service Oriented Architecture) accordingly. A robust internal audit will further help to validate the applicable changes, new controls, and effective implementation thereby reducing the likelihood of failing.
Once implemented, the benefits an organisation can accrue from it are:
a. Reduced the likelihood of a data breach, which could result in reputational damage or fines
b. Build deeper trust with existing clients and customers and appeal to new ones by boosting reputation
c. Improve efficiency and productivity across the entire organisation
d. Ensure business continuity in the event of an attempted cyberattack
e. Reduced information security costs by assessing risks and employing a more selective approach
When implemented and updated regularly, these standards can go a long way to mitigating the risks of data breaches and cybercrime. Its adoption can help inspire trust in business and provide opportunities to train staff, leading to a more productive and secure way of working.